CVE-2026-53120 Overview
CVE-2026-53120 is a use-after-free (UAF) vulnerability in the Linux kernel's PCI subsystem. The flaw resides in the handling of the driver_override field during driver probing. When a driver is probed through __driver_attach(), the bus match() callback runs without the device lock held. This unlocked access to driver_override creates a race condition that can lead to memory corruption. The fix migrates the PCI subsystem to the generic driver-core driver_override infrastructure, which provides proper internal locking.
Critical Impact
A race condition during PCI driver attachment allows concurrent access to driver_override, producing a use-after-free condition that may lead to kernel memory corruption or local privilege escalation.
Affected Products
- Linux kernel (PCI subsystem)
- Linux distributions shipping the affected kernel versions prior to the upstream patches
- Systems exposing driver_override sysfs entries to local users
Discovery Timeline
- 2026-06-24 - CVE-2026-53120 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-53120
Vulnerability Analysis
The vulnerability is a use-after-free [CWE-416] in the Linux kernel PCI driver matching path. The Linux driver model permits userspace to bind a device to a specific driver by writing to the driver_override sysfs attribute. During the bind process, __driver_attach() traverses devices on the bus and invokes the bus-specific match() callback. Per the kernel design noted in the commit, this match() invocation intentionally runs without holding the per-device lock.
The PCI subsystem's previous implementation managed its own driver_override storage and freed/reallocated the string buffer without synchronizing against readers in match(). A concurrent write to driver_override from one thread could free the string while another thread executing pci_bus_match() dereferenced it, resulting in a UAF.
The upstream fix replaces the bespoke PCI handling with the generic driver-core driver_override infrastructure, which uses proper RCU- and lock-based synchronization internally to ensure readers and writers cannot race.
Root Cause
The root cause is unsynchronized access to a heap-allocated string field. The bus match() callback reads driver_override without acquiring the device lock, while writes through sysfs free and replace the buffer. This violates the lifetime invariants of the string and produces a classic use-after-free pattern.
Attack Vector
Exploitation requires local access with permission to write to the PCI device driver_override sysfs entry, typically restricted to root or privileged users. An attacker repeatedly toggles driver_override while triggering driver attachment events. Winning the race corrupts kernel memory and can be leveraged for privilege escalation or denial of service. The vulnerability is not remotely exploitable.
No verified public exploit code is available. Refer to the upstream kernel commits (10a4206a, 58a42be0, c5b2c575, dfe950d9) for the technical fix details.
Detection Methods for CVE-2026-53120
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing pci_bus_match, __driver_attach, or driver_override in dmesg or /var/log/kern.log.
- KASAN (Kernel Address Sanitizer) reports flagging use-after-free in the PCI driver matching path on instrumented kernels.
- Unprivileged or unexpected processes writing to /sys/bus/pci/devices/*/driver_override.
Detection Strategies
- Audit kernel versions across the fleet and compare against the patched stable releases referenced in the upstream commits.
- Enable kernel auditd rules to monitor write access to PCI driver_override sysfs paths and correlate with process identity.
- Deploy KASAN or KFENCE on test kernels to surface race-induced UAF conditions before production rollout.
Monitoring Recommendations
- Forward kernel logs to a centralized SIEM and alert on crashes referencing the PCI driver matching functions.
- Track sysfs write events targeting driver_override attributes as an anomalous administrative action.
- Monitor for sudden module load or unload sequences that may indicate driver-binding race attempts.
How to Mitigate CVE-2026-53120
Immediate Actions Required
- Apply the upstream stable kernel updates that include the four referenced commits and reboot affected hosts.
- Restrict write access to /sys/bus/pci/devices/*/driver_override to trusted administrative accounts only.
- Inventory systems running unpatched kernels and prioritize multi-tenant or container hosts where local users may interact with PCI sysfs.
Patch Information
The fix is delivered through the Linux stable tree in commits 10a4206a, 58a42be0, c5b2c575, and dfe950d9. The patches migrate the PCI subsystem to the generic driver_override infrastructure, which serializes access internally. Consult your Linux distribution's security advisories for backported package versions.
Workarounds
- Limit local user accounts on systems that cannot be immediately patched, reducing the population that can race driver_override writes.
- Use mandatory access control (SELinux or AppArmor) policies to deny writes to PCI driver_override attributes from non-administrative contexts.
- Avoid exposing privileged PCI sysfs entries inside containers; ensure container runtimes mount /sys as read-only where feasible.
# Verify kernel version and check for the patched commits
uname -r
# Restrict access to PCI driver_override sysfs entries
find /sys/bus/pci/devices -name driver_override -exec chmod 600 {} \;
# Example auditd rule to monitor driver_override writes
auditctl -w /sys/bus/pci/devices -p w -k pci_driver_override
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
